CVE-2026-72126: can: isotp: use unconditional synchronize_rcu() in isotp_release()

CVE-2026-72126: can: isotp: use unconditional synchronize_rcu() in isotp_release()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: use unconditional synchronize_rcu() in isotp_release()

isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()
and clears so->bound without waiting for a grace period. isotp_release()
uses so->bound to decide whether it needs to call synchronize_rcu()
before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it
skips that synchronize_rcu() and can cancel the timer while an
in-flight isotp_rcv() is still executing and about to re-arm it via
isotp_send_fc(), leading to a use-after-free timer callback on the
freed socket.

sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),
therefore make isotp_release() always call synchronize_rcu() before
cancelling the timers, regardless of so->bound. This still closes the
original race (isotp_notify() clearing so->bound without waiting for
in-flight isotp_rcv() callers before isotp_release() cancels the RX
timer) without adding any RCU wait to the netdevice notifier path.

The Linux kernel CVE team has assigned CVE-2026-72126 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.50 with commit 22bfa94db2ef6900c790884fa9461486516626e9 and fixed in 5.10.261 with commit 945d9894502cd9124f5d676181c542ed2000f7c0
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 5.15.212 with commit 59672aa4bcd8d32172c1ff6a179583981d6acabc
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 6.1.178 with commit 15413a082df69175c2f96aeab4c26fe1ff7cff03
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 6.6.145 with commit 6280eda96e0707264849fa7d036fed873c1f8a6d
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 6.12.97 with commit cb6abc584a1bfab107ac003d64948a4aef1730aa
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 6.18.40 with commit b88a511308779c225005d7994b8744561bdbafbc
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 7.1.5 with commit b8278ff605187ef3fa0f2705e93251cce4c4f8ee
	Issue introduced in 5.14 with commit 14a4696bc3118ba49da28f79280e1d55603aa737 and fixed in 7.2-rc4 with commit 9b1a02e0d980ac6b0e36a90378f847062f81d7e4
	Issue introduced in 5.12.17 with commit 80c6ddf771df2ef786f28c1ca5919b3f1080091b
	Issue introduced in 5.13.2 with commit ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72126
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/isotp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0
	https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc
	https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03
	https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d
	https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa
	https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc
	https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee
	https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4